Accessibility Features

Adversaries may abuse pre-logon Windows accessibility features, including Sticky Keys (sethc.exe, invoked by pressing Shift five times), to establish persistence and/or elevate privileges. Methods vary by Windows version and include replacing an accessibility binary or redirecting its launch through registry configuration such as Image File Execution Options (IFEO). Some variants can provide privileged access at the logon screen; the exact execution context depends on the method and system configuration.